Creating a secure @RestController that encrypts passwords and transmits data in JSON format using Hibernate

Question

Creating a secure @RestController that encrypts passwords and transmits data in JSON format using Hibernate

When developing a login/registration form in AngularJS and using Spring Boot, I encountered an issue with encrypting passwords into the database. After registering a user, my code for sending data to the database looked like this:

@RequestMapping(value = "/register",method = RequestMethod.POST)
public User addUser(@RequestBody User user) {
    LOGGER.info("Received request to create the {}", user);
    return repo.saveAndFlush(user);
}

To address the encryption of passwords, how can I ensure that the password is securely stored in the database? Additionally, as I proceed to implement the login functionality, I am unsure how to retrieve data from the server in JSON format to AngularJS. Is this method secure, and what measures can be taken to handle password encryption effectively? Furthermore, is there a way to obscure or mask the password during validation?

angularjs spring hibernate

Answer 1

Answer №1

Typically, passwords are not encrypted but hashed to ensure that they cannot be reversed back to the original password. When a user wants to access an application, their password is hashed and compared with the stored hashed version in the database.

I rely on the spring security BCrypt password encoder for hashing operations, which is straightforward to implement.

There are plenty of examples available for password hashing in Java. Here's an example to get you started.

To send a User object in JSON format to the client, simply add the @ResponseBody annotation (Spring MVC utilizes Jackson for converting to JSON).

@RequestMapping(value = "/register",method=RequestMethod.POST)
public @ResponseBody User addUser(@RequestBody User user) {

    .....

    return user
}

Answer 2

Typically, passwords are not encrypted but hashed to ensure that they cannot be reversed back to the original password. When a user wants to access an application, their password is hashed and compared with the stored hashed version in the database.

I rely on the spring security BCrypt password encoder for hashing operations, which is straightforward to implement.

There are plenty of examples available for password hashing in Java. Here's an example to get you started.

To send a User object in JSON format to the client, simply add the @ResponseBody annotation (Spring MVC utilizes Jackson for converting to JSON).

@RequestMapping(value = "/register",method=RequestMethod.POST)
public @ResponseBody User addUser(@RequestBody User user) {

    .....

    return user
}

Creating a secure @RestController that encrypts passwords and transmits data in JSON format using Hibernate

Answer №1

Similar questions

What is the best method to retrieve a JSON record by its specific ID using Angular's AJAX functionalities?

Mysterious AngularJS Error: An Unforeseen Encounter with [$injector:modulerr]

Using AngularJS directives like ng-hide, ng-show, or ng-if to control visibility based on the active state of

The issue of the Angular controller not functioning properly in conjunction with Node Express

Challenge with Alignment of Fields in Bootstrap's Horizontal Form

What is the functionality of an Angular service that retrieves an

Ways to merge multiple cells horizontally in a table right from the beginning

Following the modification of the Context root, the JSP page is no longer functioning as expected

Tips for refining the ng-model value through AngularJS directive?

AngularJS app is not initialized by ngApp, only by ng-app

AngularJS - Embedding input fields within an HTML table within a form

Showing validation in a Bootstrap modal after it has been closed

New update to Angular Currency Filter - Now including Symbol Â!

Implementing ng-if with asynchronous functions: A step-by-step guide

Angular directives leading to extended loading durations

Enabling the acceptance of blank values within an HTML5 date input field

Issue with authentication and cross-origin resource sharing (CORS) when implementing Spring Boot, Spring Security, Vue.js,

What are the benefits of having a service dedicated to interacting with a single entity, while another service is responsible for handling a group of entities?

The $q.all() function in angular seems to struggle with resolving properly

Executing a controller method in AngularJS when redirecting a page